We have a full list of what data the University can and cannot see on your device relative to each protection level.

If you are unable to fully set up In-App Protection on your device, it may be that your device is not compliant.

This may be due to having an outdated firmware or operating system (OS) version installed on your device. In this scenario, you will need to check to see if your device can be updated to a supported OS version. Click here for a full list of currently supported OS Versions.

Your device’s OS will need to be kept up-to-date in order for you to continue using the device to access University resources and services. If your device is not on a supported version it will notify you, and after 14 days the device will no longer be able to connect to University services.

If you cannot install an up-to-date OS, you will not be able to set up your device, and cannot use it to access University resources and services. Please contact the Digital Technologies Service Desk for further guidance.

The reason we must use compliant devices is to do with the requirements of Cyber Essentials. This scheme requires devices to be kept up to date and within certain compliance thresholds. One of the key areas which will fail the compliance check is the operating system version for iOS and Android.

There could be many other reasons, but the Company Portal app or the application protection policy will show you the reason the device is non-compliant.

When opening a Microsoft Application, you will be required to set a 6-digit PIN. This is not the same PIN as you may already have on your device, and it is highly recommended that you set a different 6-digit PIN for your Microsoft Applications for extra security.

Deregistering In-App Protection

To deregister In-App Protection on your devices you will need to remove your work account in all Microsoft apps you have installed (Outlook, Teams, OneDrive etc.). This will vary between apps and platforms, but the process will be similar.

Using Outlook as an example, you will first need to open the relevant app (Outlook), then tap your profile picture and select the settings cog that appears. Tap on your University/work email under “Email Accounts”, then scroll to the bottom and select “Remove Account”. Please note that if you have OneDrive set up, you will also need to scroll to “Storage Accounts” and repeat this process.

To fully deregister, you will need to do this in each Microsoft application installed on your device.

Deregistering Full Device Protection

To deregister from full device protection, you will need to open the Company Portal app, then select your device. Tap the three dots, then select “Remove Device”. This will remove the associated work partition/profile and any University data saved on the device.

If you wish to access any browser-based University services from your device with in-app protection, such as the Staff Directory etc., you will need to use Edge as your browser. This is because Edge is managed by Microsoft and is therefore compliant.

If you have the Company Portal App installed and Full-Device Protection set up on your device, you should be able to access these services with no issues.

When installed on an Apple device, the Microsoft Authenticator App works in the same way as the Microsoft Company Portal app (as well as providing you all the benefits of a faster MFA process when configured). It checks your device is compliant and allows you to use In-App Protection, rather than having to set up Full Device Protection.

Android users need to download the Microsoft Company Portal app to allow this same level of compliance check. You do not need to open/sign into the app or configure it for this to work, simply have it installed on your device.

For Full Device Protection on Apple or Android, you will need to install the Microsoft Company Portal app and configure it.

Yes. The Microsoft Authenticator App can still be used for Multi-Factor Authentication, even if your device is not registered with Intune.

Depending on your type of device and your the level of Intune protection you have set up, a different offering of apps are in scope. This includes Teams and Outlook, but for a full list please visit Supported Microsoft Intune apps | Microsoft Learn which is updated by Microsoft as new apps are added.

If you have your device set up for the In-App Protection option, just install apps from the App Store or Play Store as normal.

Please Note: You may be unable to copy and paste data from these apps, or take screenshots. You may also have issues opening links from these apps unless you install the Microsoft Edge app.

If you have your device set up for the Full Device Protection option, you will need to install apps differently depending on your device:

When using an Apple device on Full Device Protection, apps which access University data will need to be installed from within the Intune Company Portal app.

When using an Android device on Full Device Protection, apps which access University data will need to be installed from the managed Play Store within your work partition. Your work partition may display as a separate tab, or as a briefcase icon on your home screen.

If you choose to install Full Device Protection on an Apple device, this will allow the University access to remotely wipe or reset your device in extreme circumstances – e.g. should your device be lost or stolen – to protect University data. This would only be done in the most extreme circumstances, such as if your device was lost or stolen; this would only be done at the user’s request with a governance process in place to ensure the appropriate application of policy.

If you choose to install Full Device Protection on an Android device, this will allow the University access to remotely wipe University data from your device in extreme circumstances – e.g. should your device be lost or stolen – to protect University data. This would only be done in the most extreme circumstances, such as if your device was lost or stolen; this would only be done at the user’s request with a governance process in place to ensure the appropriate application of policy.

However, if you do not require Full Device Protection, you should instead use the “Option 1 – In-App Protection”. Using Option 1 provides protection only for specific applications such as the Teams, Outlook and OneDrive apps, meaning the University will not be able to wipe/reset your device.